CLAIMS 

WHAT IS CLAIMED IS : 

\l. A method for detecting potentially harmful actions on a handheld 
computerize method comprising: 

monitoring calls to applications resident on the handheld computer; 

identifying\code associated with a program initiating said call; and 

at least temporarily preventing an action requested by said call from being 
executed if the identified co^e does not correspond to a code associated with data 
said action is to be performed i^on. 

2. The method of claim 1 wherein monitoring calls to applications 
comprises installing a patch on the handhera computer, the patch being operable 
to intercept calls. \ 

3. The method of claim 2 wherein installing a \atch comprises replacing 
an API address with a patch address. \ 
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Yk The method of claim 2 wherein installing a patch comprises utilizing 
get trap akd set trap commands. 

5. The method of claim 1 wherein identifying a code comprises 
identifying a creator code on a Palm operating system. 

6. The method oiSclaim 1 further comprising identifying at least one of 
the applications as a trustedVpplication, wherein trusted applications are not 
prevented from performing actions. 

7. The method of claim 1 further comprising receiving data on an infrared 
port of the handheld computer and installing said data in a temporary database. 

8. The method of claim 7 further comprising asking a user whether to 
accept said data before loading said data onto theJiandheld computer. 

9. The method of claim 1 wherein the action requested is a password 
manipulation. \ 
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\ 10. The method of claim 1 wherein the action requested is deletion of 
data. \ 

1 1 . The, method of claim 1 wherein the action requested is modification of 
data. \ 

12. The method Vf claim 1 wherein the action requested is manipulation 
of an operating system. \ 

1 3 . A method for detectingypotentially harmful actions on a handheld 
computer, the method comprising: \ 

monitoring requests for action bjNapplications on the handheld computer; 

evaluating said requests to determines if said requests may result in 
potentially harmful behavior to data stored on\he handheld computer; 

preventing said action from being performed if said request is identified as 
potentially harmful behavior; and \ 

notifying a user of the handheld computer of said potentially harmful 



behavior. 
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14\The method of claim 13 wherein monitoring requests for action 
comprises monitoring API calls. 

15. The method acclaim 13 wherein evaluating said requests comprises 
comparing a creator code assorted with the application requesting said action 
with a creator code associated witmdata the action is to be performed upon. 

16. The method of claim 13 further comprising identifying at least one 
application as a trusted application and allowing s&id action to be performed even 
if said request is identified as potentially harmful if requested by the trusted 
application. \ 
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\ 17. A computer program product for detecting possibly harmful actions 
on a handheld computer before the actions are executed, the product comprising: 

computer code that monitors calls to applications resident on the handheld 
computer; \ 

computer code that identifies a code associated with a program initiating 
said call; \ 

computer codeNthat at least temporarily prevents an action requested by 
said call from being performed if the identified code does not correspond to a 
code associated with data sard action is to be performed upon; and 

a computer readable meomm that stores said computer codes. 

18. The computer product of clarm 17 further comprising code that 
identifies at least one of the applications as a\trusted application and wherein 
trusted applications are not prevented from perrorming actions. 

19. The computer product of claim 17 whereirrthe computer code that 
monitors calls to applications is a patch configured for usesin a Palm operating 
system. \ 
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Xp. A computer program product for detecting possibly harmful actions 
on a handheld computer before the actions are executed, the product comprising 

computerqpde that monitors requests for action by applications on the 
handheld computer; \ 

computer code that evaluates said requests to determine if said requests 
may result in potentially harmfui^behavior to data stored on the handheld 
computer; \ 

computer code that prevents said action from being performed if said 
request is identified as potentially harmful betWior; 

computer code that notifies a user of the handheld computer of said 
potentially harmful behavior; and \ 

a computer readable medium that stores said computencodes. 
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